---
title: "List"
method: GET
path: "/api/v1/apps/{app_id}/xaa/scopes"
tags: ["Cross-App Access"]
---

# List

`GET /api/v1/apps/{app_id}/xaa/scopes`

List the scopes defined for an application, one page at a time. To filter
 by resource server, state, or classification, use Search.

## Path parameters

- `app_id` string, required — The application to list scopes for.

## Query parameters

- `page_size` integer — Page size (max 100).
- `page_token` string — Page token for pagination.

## Response `200`

XAAScopeServiceListResponse returns a page of scopes.

- C1ApiCrossAppAccessV1XAAScopeServiceListResponse — XAAScopeServiceListResponse returns a page of scopes.
  - `nextPageToken` string — Token for the next page, or empty if there are no more results.
  - `scopes` C1ApiCrossAppAccessV1XAAScope[], nullable — The page of scopes.
    - `appEntitlementId` string — The AppEntitlement created for this scope.
    - `appId` string — The application that owns the resource server.
    - `classification` 'XAA_SCOPE_CLASSIFICATION_UNSPECIFIED' | 'XAA_SCOPE_CLASSIFICATION_READ' | 'XAA_SCOPE_CLASSIFICATION_WRITE' | 'XAA_SCOPE_CLASSIFICATION_DESTRUCTIVE' | 'XAA_SCOPE_CLASSIFICATION_SENSITIVE' | 'XAA_SCOPE_CLASSIFICATION_DANGEROUS' — Risk classification.
    - `createdAt` string, date-time, nullable
    - `deletedAt` string, date-time, nullable
    - `description` string — Description of what the scope grants.
    - `displayName` string — Display name for the scope.
    - `id` string — Unique identifier for this scope.
    - `lastDiscoveredAt` string, date-time, nullable
    - `scopeValue` string — The literal OAuth scope string minted into the grant. Immutable after creation (RFC 6749 charset, max 256 bytes).
    - `source` 'XAA_SCOPE_SOURCE_UNSPECIFIED' | 'XAA_SCOPE_SOURCE_ADMIN_DECLARED' | 'XAA_SCOPE_SOURCE_DISCOVERED' — How C1 learned of the scope.
    - `state` 'XAA_SCOPE_STATE_UNSPECIFIED' | 'XAA_SCOPE_STATE_PENDING_REVIEW' | 'XAA_SCOPE_STATE_ENABLED' | 'XAA_SCOPE_STATE_DISABLED' | 'XAA_SCOPE_STATE_REMOVED' — Approval/lifecycle state.
    - `updatedAt` string, date-time, nullable
    - `xaaResourceServerId` string — The resource server this scope belongs to.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)